Privacy Policy - The Organized Forge

Last updated: 11 October 2026

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and the Italian data protection rules (Legislative Decree 196/2003 as amended by Legislative Decree 101/2018). It explains how data collected through this website is handled.

1. Data controller

The Organized Forge is run by Filippo Calabrese, VAT number (P.IVA) IT07459710484, Via Giovanni Paisiello 15, 50144 Florence, Italy. For any privacy request write to hello@filippocalabrese.com.

No Data Protection Officer has been appointed, because the conditions of Article 37 GDPR do not apply: the controller is not a public authority, does not carry out large-scale systematic monitoring and does not process special categories of data as a core activity.

2. What data is collected and why

Only the data strictly needed for what the website actually does.

2.1 Contact form

Data: name, email address, subject, message and the page the form was sent from.
Purpose: answering your request.
Legal basis: steps taken at your request (Art. 6(1)(b) GDPR) and legitimate interest in replying to messages (Art. 6(1)(f) GDPR).
Retention: as long as needed for the conversation and its follow-up, and no longer than 24 months.
Processor: Resend, for the technical delivery of the email sent from the form (see section 5).

2.2 Newsletter

Data: email address, date and page of signup, the wording of the consent given and a one-way hash of the IP address, used only to prevent abuse.
Purpose: sending occasional emails about new titles and seasonal picks.
Legal basis: explicit consent (Art. 6(1)(a) GDPR), given by ticking the box when you sign up.
Retention: until you unsubscribe, which you can do at any time from the link in every email or by writing to hello@filippocalabrese.com.
Processor: Resend, for managing the subscriber list and sending the emails (see section 5).

2.3 Usage statistics

Data: aggregated browsing data: pages viewed, traffic source, device type and country. No cookies, no full IP addresses stored, no persistent individual identifiers.
Purpose: understanding which pages are useful and improving the website.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR). The tool is self-hosted, does not use cookies and only produces anonymous aggregate figures, so it falls within the measurement tools that the Italian Garante’s guidelines of 10 June 2021 allow without consent.
Retention: aggregated data is kept for up to 24 months.
Processor: Plausible Analytics, self-hosted on European infrastructure controlled by the data controller (plausible.selli.cloud). No external sub-processor is involved.

2.4 Server logs

Data: IP address, browser, pages requested, date and time.
Purpose: security and keeping the website running.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Retention: a short period, after which logs are deleted. They are not used to profile visitors.

3. What this website does not do

No advertising or tracking tools are installed, and the only statistics tool is the cookieless one described above.
No profiling cookies are set (see the Cookie Policy).
Fonts and images are served from this website, not from third-party services.
Data is never sold or rented, and is not used for automated decision-making or profiling.

4. Purchases happen on Etsy

Nothing is sold directly on this website. When you click Get it on Etsy you leave this site, and Etsy processes your order, payment and downloads under Etsy’s Privacy Policy. As a seller, The Organized Forge receives from Etsy only the order details needed to deliver and support your purchase.

5. Recipients and processors

Data may be handled by the following parties acting as data processors under Article 28 GDPR, with data processing agreements in place:

Resend Inc. (USA): delivery of emails sent from the contact form, and management of the newsletter through its Audiences service (subscriber list, proof of opt-in, sending). Transfer governed by Standard Contractual Clauses. resend.com/legal/privacy-policy
Plausible Analytics (self-hosted): cookieless statistics on European infrastructure controlled by the data controller. No external sub-processor is involved.
The hosting provider that runs the server of this website.

Data is not disclosed to anyone else, is not published and is not used for automated decision-making or profiling.

6. Transfers outside the EU

Resend is based in the United States. The transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU-US Data Privacy Framework. Data is encrypted in transit and at rest.

7. Links to other websites

Links to Etsy, to our social profiles (Instagram, TikTok, Pinterest) and share links take you to third-party websites with their own privacy policies.

8. Your rights

At any time you can exercise the rights set out in Articles 15 to 22 GDPR:

access to your data (Art. 15);
rectification (Art. 16);
erasure, the “right to be forgotten” (Art. 17);
restriction of processing (Art. 18);
data portability (Art. 20);
objection to processing based on legitimate interest (Art. 21);
withdrawal of consent at any time, without affecting the lawfulness of earlier processing (Art. 7(3)).

Write to hello@filippocalabrese.com; you will receive an answer within 30 days. If you believe your data is being processed unlawfully, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali.

9. Minors

This website is not aimed at children under 16 and does not knowingly collect their data. If you are a parent or guardian and believe a minor has provided data, write to hello@filippocalabrese.com and it will be deleted.

10. Changes to this notice

This notice may be updated to reflect technical, organisational or legal changes. The date of the last update is shown at the top. If substantial changes are made, such as new processors, new purposes or a different legal basis, newsletter subscribers will be informed by email.